CVE-2026-63894

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...

CVE-2026-63885

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

CVE-2026-64178 Bluetooth: bnep: Fix UAF read of dev->name

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection needs to keep holding the bnepsessionsem while reading dev-name just like bnepgetconnlist does; otherwise the bnepsession thread can concurrently free the netdevice, whi...

CVE-2026-64142 ksmbd: close durable scavenger races against m_fp_list lookups

In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against mfplist lookups ksmbddurablescavenger has two related races against any walker that iterates fci-mfplist, including ksmbdlookupfdinode used by ksmbdvfsrename and the share-mode checks ...

CVE-2026-64142

CVE-2026-64142 documents a Linux kernel issue in ksmbd where two races against m_fp_list walkers can lead to use-after-free or list corruption during durable-handle scavenging. The root causes are: (1) fp->node list-head reuse when expired handles are moved to a scavenger list, which can overw...

EUVD-2026-45826

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compareguidkey sessionfdcheck walks the per-inode moplist during durable-handle session teardown and sets op-conn = NULL for every opinfo whose conn matched the closing session's connection...

CVE-2026-64136 smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tccount increment in smb2findsmbsesstconunlocked Commit 96c4af418586 "cifs: Fix locking usage for tcon fields" refactored cifs code to change cifstcpseslock for tclock around tccount changes. There was missin...

CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64112 rbd: eliminate a race in lock_dwork draining on unmap

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

EUVD-2026-45797

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

CVE-2026-64112 rbd: eliminate a race in lock_dwork draining on unmap

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

CVE-2026-64109 af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

In the Linux kernel, the following vulnerability has been resolved: afunix: Fix UAF read of tail-len in unixstreamdatawait unixstreamdatawait does skbpeektail&sk-skreceivequeue without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since...

CVE-2026-64109

In the Linux kernel, the following vulnerability has been resolved: afunix: Fix UAF read of tail-len in unixstreamdatawait unixstreamdatawait does skbpeektail&sk-;skreceivequeue without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since...

EUVD-2026-45794

In the Linux kernel, the following vulnerability has been resolved: afunix: Fix UAF read of tail-len in unixstreamdatawait unixstreamdatawait does skbpeektail&sk-skreceivequeue without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since...

CVE-2026-64108 cifs: Fix busy dentry used after unmounting

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c "cifs: open files should not hold ref on superblock", cifs file only holds the dentry refcnt, the cifs file close workcfile-deferred could be executed after...

EUVD-2026-45793

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c "cifs: open files should not hold ref on superblock", cifs file only holds the dentry refcnt, the cifs file close workcfile-deferred could be executed after...

CVE-2026-64091 batman-adv: tt: fix TOCTOU race for reported vlans

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

CVE-2026-64091 batman-adv: tt: fix TOCTOU race for reported vlans

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

CVE-2026-64091

CVE-2026-64091 affects batman-adv in the Linux kernel, addressing a TOCTOU race in the TT-based TVLV generation for reported VLANs. The issue arises because the buffer used to hold VLAN entries is sized based on a prefilter that may undercount or overcount VLANs during parallel updates, while the...

CVE-2026-64079 netfilter: x_tables: allocate hook ops while under mutex

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...